Overview

overview

10

Static

static

10

2026-08-03...ry.exe

windows10-2004-x64

10

2026-08-03...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/08/2026, 16:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_c24181282bea184e85b2c70d0c4d6fe6_elex_wannacry.exe
  • Size 1.0MB
  • Sample260803-vhn4mafp7s
  • SHA256 345fc2881e91eeb730c74e72d4c7cb9a6f036652ab94e48cd6ee6094c7d5c5e5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoorcredential_accessdiscoveryexpirospywarestealer

Malware Config

Signatures

  • Family: Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 1 IoCs
    backdoor
  • Detects executables packed with VMProtect. 25 IoCs
  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 61 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c24181282bea184e85b2c70d0c4d6fe6_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_c24181282bea184e85b2c70d0c4d6fe6_elex_wannacry.exe"
    1⤵
    • Drops Chrome extension
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2284
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3208
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4384
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:3180
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1316
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:5012
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    PID:3880
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    PID:1668
  • C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\servicing\TrustedInstaller.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1528

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.7MB
        • SHA256 08a25496a6dbcac0a7807e3d34a0448c1f966c3a17081fc572f2e1df5cbdb74f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 820KB
        • SHA256 a5f3aa4e7577c04da9d4efb803ed56776e47058cc32ab8333002255c49defdc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 800KB
        • SHA256 7b0344fccf4237d380ed529855de0cd1e211e530f54d30c2c76b33e0ae11e651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.vir
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.vir
        • Size 6.6MB
        • SHA256 0c42821562df865798f6ac993c0e3b4a25e3c3bd5c7bf8e588d60a599917ee69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.8MB
        • SHA256 8b4b5c1a7bf8747ab618b0384f9b96d7ce7dbc041c82f9d2b63b668720efdda9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iexplore.exe
        • Path C:\Program Files\Internet Explorer\iexplore.exe
        • Size 1.3MB
        • SHA256 f8c78fe4ac619a8d2a4deda120a4db4521edbb0daa43020bdcb385632d4849c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        powershell.exe
        • Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        • Size 983KB
        • SHA256 c5782f45f3babb5921a3defbe90762cea1822d72443e640fc5d68375946fab31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.7MB
        • SHA256 7a55812ac33c655dcf87752c1eb1b0ae9621742f58845497d8910f33a1fc9ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Appvclient.vir
        • Path C:\Windows\System32\Appvclient.vir
        • Size 1.3MB
        • SHA256 acd8794dba78f6b1a4bcb384767a986ab52b4bf510900a1b892239d4d0f16672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 934KB
        • SHA256 c1598e80ffcb598c6abc210ba803ee09134214ea8fba6fd4689fb36161afe140
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.1MB
        • SHA256 870cc44c651c98f77de2d345bc01478d0705c479c8793c3846ee9bb234221ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TrustedInstaller.exe
        • Path C:\Windows\servicing\TrustedInstaller.exe
        • Size 193KB
        • SHA256 73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1316-48-0x0000000140000000-0x000000014021A000-memory.dmp
        Download

        memory/1316-47-0x0000000140000000-0x000000014021A000-memory.dmp
        Download

        memory/1668-74-0x0000000140000000-0x0000000140361000-memory.dmp
        Download

        memory/1668-73-0x0000000140000000-0x0000000140361000-memory.dmp
        Download

        memory/2284-0-0x0000000000400000-0x000000000062B000-memory.dmp
        Download

        memory/2284-15-0x0000000000400000-0x000000000062B000-memory.dmp
        Download

        memory/3180-29-0x0000000140000000-0x0000000140220000-memory.dmp
        Download

        memory/3180-28-0x0000000140000000-0x0000000140220000-memory.dmp
        Download

        memory/3208-16-0x0000000140000000-0x0000000140434000-memory.dmp
        Download

        memory/3880-67-0x0000000140000000-0x000000014030B000-memory.dmp
        Download

        memory/3880-66-0x0000000140000000-0x000000014030B000-memory.dmp
        Download

        memory/4384-22-0x0000000140000000-0x000000014041F000-memory.dmp
        Download

        memory/5012-60-0x0000000140000000-0x000000014024D000-memory.dmp
        Download

        memory/5012-59-0x0000000140000000-0x000000014024D000-memory.dmp
        Download